upheollds-laaggniz[.]godaddysites[.]com

This domain is flagged as an active phishing portal designed to harvest user credentials through a counterfeit Uphold login interface. Analysis indicates the site specifically targets cryptocurrency platform users, presenting a high-fidelity replica of the legitimate Uphold authentication page under the title 'Uph𝓸ld Login | Sign In.' The threat type is classified as credential harvesting with elevated risk due to its targeted nature and operational sophistication. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 22, 2026, and currently resolves to IP address 13.248.243.5 hosted on Amazon.com, Inc. infrastructure (AS16509). Security telemetry shows 19 out of 95 detection engines flagged the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by GoDaddy.com, Inc. via the Go Daddy Secure Certificate Authority - G2, providing a superficial layer of legitimacy while failing to prevent detection by security systems. Mitigation requires immediate action from both organizational and individual perspectives. Network administrators should implement DNS-based blocking for the domain and its associated IP address 13.248.243.5 at perimeter security controls. End users who may have interacted with the site must immediately reset credentials for any accounts entered on the portal, particularly Uphold and other cryptocurrency services. Organizations should deploy multi-factor authentication for all financial and cryptocurrency-related accounts to mitigate the impact of potential credential compromise. Security teams are advised to monitor for follow-on phishing attempts using similar domain spoofing techniques, particularly those leveraging homoglyph characters in the page title.